Security team shuts down dormant Popcorn Time updater
Researchers disabled an insecure update mechanism on millions of devices to prevent a potential botnet threat.
By Leila Reynolds ·
Security researchers have disabled the automatic updater for a dormant version of the Popcorn Time streaming software to stop it from being exploited as a tool for building a botnet. The software, which allowed users to stream movies and TV shows via torrents, has seen no official development in years. However, copies remain installed on millions of computers worldwide, leaving those machines vulnerable to remote control by attackers.
Eye Security identified that the updater for a fork of the software named Time4Popcorn was still active on Windows, macOS, and Android systems. The mechanism connected to web domains that had been abandoned by their original owners. These connections occurred over unencrypted HTTP and relied on an outdated, insecure version of the Chrome browser engine. This combination of factors created a significant security gap for the installed devices.
Niels Teusink of Eye Security explained that the vulnerability allowed an attacker to install and run almost any software with full privileges. By taking over one of the abandoned domains, a malicious actor could have recruited these devices into a botnet. Alternatively, an attacker could have targeted specific machines using a man-in-the-middle attack or identified which users were running the software for surveillance purposes.
The research team addressed the issue by registering one of the abandoned domains and delivering an update that instructed the updater to shut itself down. Teusink noted that the update process was not performing any useful function and was only creating risk. The team acknowledged ethical questions about modifying software on user devices but stated that inaction was the only other option. They transferred the domains to the Shadowserver Foundation, a non-profit web security organization, after concluding the project.
The update for Windows systems stopped and disabled the service through the Service Control Manager without deleting files. On macOS, a shell script executed a command that prevented the update process from starting. Android devices were left unchanged because installing an update on that platform requires direct user action. The team initially uploaded their update to VirusTotal, a security database, which flagged the file as malware and blocked it on some machines. The researchers had to adjust the update to resolve this conflict before distribution was complete.
The total number of vulnerable devices is not precisely known. Eye Security reported distributing over two million update downloads by March of this year. The team stopped distributing the update at that point after the domains were transferred to the Shadowserver Foundation. The software itself remains installed on user devices, but the specific risk posed by the active updater has been removed.
